Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


    Cloudron Forum

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular

    Scoped API tokens

    Feature Requests
    api token
    1
    1
    171
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      fiwand last edited by girish

      Access tokens currently inherit the full set of permissions from their owners. We'd love to be able to limit the routes that can be accessed by an individual token.

      Proposed solution

      Since predefined scopes are difficult to get right, we propose to instead support a path-based allowlist for a token (as a multiline plain text) in the "Create API Token" modal, where each line specifies an allowlisted route, possibly with wildcards for individual segments. Example:

      GET /api/v1/cloudron/graphs
      GET /api/v1/notifications
      GET /api/v1/notifications/*
      GET /api/v1/apps/*/logs
      

      Note: The inclusion of the base path and syntax for wildcards or patterns may need some further discussion.

      Use cases

      • Custom dashboards: We created a custom dashboard in Observable where we consume the apps and cloudron/graphs routes. This dashboard cannot currently be shared with users who have a lower access privilege as it would expose an admin-level token.
      • CI/CD hardening: We are currently investigating how we can reduce the risk of privilege escalation in a CI/CD environment. An admin-level token is currently used to create and tear down staging apps, and to configure their aliases. Once Cloudron 6.4 has been released we might also assign operators this way. Restricting routes may offer some level of risk reduction should a user gain access to the token.

      Alternatives

      We might be able to set up an HTTP proxy as API middleman. The proxy would be configured with an admin-level token, but would manage an internal set of tokens with their own set of retrictions.

      1 Reply Last reply Reply Quote 5
      • First post
        Last post
      Powered by NodeBB